Artificial intelligence has uncovered a PHP security crisis reaching across the web. Two critical vulnerabilities affect PHP releases dating back to version 5.4, putting about 70 percent of the world’s websites in the crosshairs and triggering an urgent patching effort.
The flaws carry a severity score of 9.2 out of 10, and the danger is already visible in the attack data. Cloudflare detected thousands of attempts to exploit the vulnerabilities during the 10 hours before public disclosure. Within 45 minutes after the announcement, attempts reached tens of thousands; within two hours, they climbed into the hundreds of thousands, with millions recorded overall.
Two PHP Flaws Create a Direct Path to Servers
The first vulnerability, CVE-2026-109618, involves how PHP handles errors when it runs out of memory. The second, CVE-2026-109619, involves PHP retaining outdated information in its memory. Both problems can lead to unsafe memory operations and remote code execution, giving attackers a route into systems that process PHP requests.
The vulnerabilities involve PHP’s handling of memory and internal state while processing requests. That technical weakness can produce consequences far beyond a failed page or a temporary service problem. Attackers could gain unauthorized access to servers, steal sensitive information, modify website content, install malware, deface websites, or take affected sites offline.
“Two critical security flaws were discovered in PHP that could allow hackers to take control of vulnerable website servers and potentially steal customer information, change website content, install malware or take the website completely offline,” said Voldemaras Kadys.
The PHP project’s advisory confirms that the risk reaches several configurations, including:
- PHP-FPM
- Apache’s mod_php
- php-cgi
- FrankenPHP
- LiteSpeed
Rahat Masood described the stakes in direct terms: “Once they are in the servers, they can do anything they want — from stealing sensitive information to modifying website content.”
AI Found the Weaknesses Before Attackers Moved
Calif, a security research firm, found the flaws in August using OpenAI’s GPT-5.6 Sol model. Calif reported the first flaw to PHP on August 11, 2026, and Wiz reported a second flaw on August 24, 2026, after independently discovering additional vulnerabilities with AI models from Google and OpenAI.
That discovery path puts AI at the center of a major security event. The systems did not uncover an obscure issue in an isolated experiment; they helped identify weaknesses in a programming language that supports about 70 percent of websites worldwide.
Wiz described the findings with a stark warning: “These findings rank among the most severe vulnerabilities discovered in PHP, and arguably in software history.” Volker Dusch called the incident “the most serious problem PHP had faced in more than a decade,” comparing it to Heartbleed.
PHP first launched in 1995 and has been used to build websites since the early 2000s. Its reach has made the vulnerabilities difficult to contain because PHP is embedded across the internet, including in systems where operators may not realize the language is running.
“PHP is everywhere — not everyone who is using it even knows that they’re using it because it’s this ubiquitous technology that’s been baked into the internet for years and years,” said Robert McMillan.
Patch Now or Take Vulnerable Sites Offline
The PHP development team released fixes on October 21, 2026. The PHP Foundation issued a direct instruction to operators: “If you run PHP, it is imperative that you update now.” The foundation also said the announcement on php.net contains technical details about the vulnerabilities, attack vectors, and instructions for updating affected systems.
The warning carries extra weight because exploitation attempts surged after disclosure. Cloudflare’s figures show attackers moved from thousands of attempts before the announcement to millions overall after details became public. Every unpatched server therefore faces pressure from an active and expanding attack campaign.
The US National Security Agency urged operators to patch affected systems. The European Union cybersecurity response team, CERT-EU, advised operators to take affected websites offline when they remain vulnerable.
For organizations running PHP, the immediate priority is clear: identify every affected release and configuration, apply the fixes released on October 21, and remove vulnerable websites from public access when patching cannot happen at once. The danger reaches beyond a single application because unsafe memory operations can open the server itself to remote code execution.
This incident also signals a new race in software security. AI helped researchers expose the weaknesses, while attackers began testing them at scale as soon as the details emerged. PHP powers a vast portion of the web, and the next phase depends on how fast operators close the gap between discovery and protection.
Based on
- Internet on Alert as AI Uncovers Critical Flaws in PHP Used by 70% of Websites — analyticsindiamag.com
- Websites go dark as AI exposes critical security flaws | AFP.com — origin-zh9p7m-www.afp.com
- What to know about the PHP bug affecting 70% of the world’s websites – CBS News — cbsnews.com
- What is PHP and why has it caused chaos for millions of websites? | The Independent — independent.co.uk
